{"id":17684557,"url":"https://github.com/k0p1-git/stacks2020-voicesinthehead","last_synced_at":"2026-02-10T07:32:26.432Z","repository":{"id":126968612,"uuid":"319492370","full_name":"K0p1-Git/stacks2020-VoicesInTheHead","owner":"K0p1-Git","description":"A short writeup on STACKS2020 CTF - Voices in the head challenge (Forenisc)","archived":false,"fork":false,"pushed_at":"2020-12-08T03:05:06.000Z","size":1520,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-08-26T06:39:46.417Z","etag":null,"topics":["ctf","forensic","govtech","stacks2020","writeup"],"latest_commit_sha":null,"homepage":"https://dev.to/k0p1/stacks-2020-ctf-voices-in-the-head-forensic-1bea","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/K0p1-Git.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-12-08T01:35:00.000Z","updated_at":"2020-12-08T06:25:55.000Z","dependencies_parsed_at":"2023-06-19T09:51:56.854Z","dependency_job_id":null,"html_url":"https://github.com/K0p1-Git/stacks2020-VoicesInTheHead","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/K0p1-Git/stacks2020-VoicesInTheHead","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/K0p1-Git%2Fstacks2020-VoicesInTheHead","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/K0p1-Git%2Fstacks2020-VoicesInTheHead/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/K0p1-Git%2Fstacks2020-VoicesInTheHead/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/K0p1-Git%2Fstacks2020-VoicesInTheHead/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/K0p1-Git","download_url":"https://codeload.github.com/K0p1-Git/stacks2020-VoicesInTheHead/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/K0p1-Git%2Fstacks2020-VoicesInTheHead/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29293987,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-10T03:42:42.660Z","status":"ssl_error","status_checked_at":"2026-02-10T03:42:41.897Z","response_time":65,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ctf","forensic","govtech","stacks2020","writeup"],"created_at":"2024-10-24T10:23:56.671Z","updated_at":"2026-02-10T07:32:26.406Z","avatar_url":"https://github.com/K0p1-Git.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"\n# [Stacks 2020 CTF] Voices in the Head - Forensic\n\n## \u003cu\u003eChallenge Text\u003c/u\u003e\n\n\u003cbr\u003e\n\u003cp align=\"center\"\u003e\n\u003cimg src=\"./images/challenge-text.png\" alt=\"challenge-text\"/\u003e\u003cbr\u003e\n\u003ci\u003eVoices in the Head - Challenge Text\u003c/i\u003e\n\u003c/p\u003e\n\n## \u003cu\u003eIntroduction\u003c/u\u003e\n\nVoices in the head is a 2000 point forensic challenge. Along with the challenge text and an audio file named `forensic-challenge-2.wav` a hint was distributed to all teams as a starting point.\n\n## \u003cu\u003eSolution\u003c/u\u003e\n\nThe first thing we did was to open up the WAV file and check out the content. We were immediately rewarded with a loud deafening sound of what seems like birds chirping early in the morning... 😅\n\nNow based off our limited CTF experience with the forensic challenges, usually, when an audio file is involved, it usually means steganography of some sort. We pulled out the trusty `Sonic Visualiser` tool and added a Spectrogram to the mix ... lo and behold, *** magic ✨***\n\n\n\u003cbr\u003e\n\u003cp align=\"center\"\u003e\n\u003cimg src=\"./images/sonic-visualiser-1.png\" alt=\"sonic-visualiser-1\"/\u003e\u003cbr\u003e\n\u003ci\u003eEnabling Spectrogram in Sonic Visualiser\u003c/i\u003e\n\u003c/p\u003e\n\u003cbr\u003e\n\n\nThere you go, we actually found something. The text extracted from the audio reads `aHR0cDovL3d3dy5wYXN0ZWJpbi5jb20vakVUajJ1VWI=`. Notice the equal sign at the back of this string?  Based on past experiences in CTFs, this is a telltale sign which indicates that this string is `base64 encoded`. To decode this, we simply head over to \u003ca href=\"www.base64decode.org \"\u003ewww.base64decode\u003c/a\u003e and decode our string.\n\n\n\u003cbr\u003e\n\u003cp align=\"center\"\u003e\n\u003cimg src=\"./images/base64decode.png\" alt=\"base64decode\"/\u003e\u003cbr\u003e\n\u003ci\u003eOnline Base 64 Decoder\u003c/i\u003e\n\u003c/p\u003e\n\u003cbr\u003e\n\n\nA Paste Bin link? Alright, let us go check it out ...\n\n\n\u003cbr\u003e\n\u003cp align=\"center\"\u003e\n\u003cimg src=\"./images/pastebin.png\" alt=\"pastebin\" /\u003e\u003cbr\u003e\n\u003ci\u003eSecret Paste Bin Site\u003c/i\u003e\n\u003c/p\u003e\n\u003cbr\u003e\n\n\nOh, what this? We have seen this before! Once again, with our limited CTF experience, we have come across challenges in the past that used this weird programming language / syntax. This language is known as `Brain Fuck` 🤔 \n\n\nNow, if you never saw this before, you can easily copy and paste the symbols into our trusty friend, ***Google***, to find out what the symbols mean. That's how we came to learn about this weird programming language / syntax in the first place. \n\n\n\nSo to decode this, we can use \u003ca href=\"https://www.dcode.fr/brainfuck-language\"\u003ehttps://www.dcode.fr/brainfuck-language\u003c/a\u003e to decode the message:\n\n\n\u003cbr\u003e\n\u003cp align=\"center\"\u003e\n\u003cimg src=\"./images/brainfuck.png\" alt=\"brainfuck\" /\u003e\u003cbr\u003e\n\u003ci\u003eDecoding Brain Fuck\u003c/i\u003e\n\u003c/p\u003e\n\u003cbr\u003e\n\n\nWhat?! After decoding the message, we got the string `thisisnottheflag`. 🤬 did the challenge just pull one on us? At this point we were quite lost, seeing how all of what we did lead to nowhere...\n\n\n\nBut a light bulb 💡 moment came and we realised we had not touched the initial hint that was provided! `Xiao wants to help. Will you let him help you?`  Who is this Xiao, and why would he want to help us? ***Find out more on the next episode of Dragon Ball-Z*** ... (we ended up just Googling it)\n\n\n\nBased on the hint, we came across a tool called \u003ca href=\"https://xiao-steganography.en.softonic.com/\"\u003eXiao Steganography\u003c/a\u003e, which seemed to fit what we were doing. Another steganography tool 🤔\n\n\n\u003cbr\u003e\n\u003cp align=\"center\"\u003e\n\u003cimg src=\"./images/xiao-steg.png\" alt=\"xiao-steg\" /\u003e\u003cbr\u003e\n\u003ci\u003eXiao Steganography Tool\u003c/i\u003e\n\u003c/p\u003e\n\u003cbr\u003e\n\n\nRunning it against our WAV file, it seems that a ZIP file was detected!! We attempted to open up the zip file ... and we got an error? 🤷‍♂️ What?\n\n\u003cbr\u003e\n\u003cp align=\"center\"\u003e\n\u003cimg src=\"./images/error.png\" alt=\"error\" /\u003e\u003cbr\u003e\n\u003ci\u003eXiao Steganography Tool\u003c/i\u003e\n\u003c/p\u003e\n\u003cbr\u003e\n\n\nWe tried throwing the ZIP file into \u003ca href=\"https://www.x-ways.net/winhex/\"\u003eWinHex\u003c/a\u003e and discovered that the magic numbers were all messed up, is this a broken zip challenge?\n\n\n\u003cbr\u003e\n\u003cp align=\"center\"\u003e\n\u003cimg src=\"./images/winhex.png\" alt=\"winhex\" /\u003e\u003cbr\u003e\n\u003ci\u003eWin Hex on extracted ZIP\u003c/i\u003e\n\u003c/p\u003e\n\u003cbr\u003e\n\n\nWe can see the magic numbers are all off. Not only that, it seems like the whole zip is messed up. Maybe its not a broken ZIP challenge after all ... now what? 🙃\n\nWait a minute ... could it be password protected? ***Its at this moment another light bulb appeared💡***\n\nRemember when we decoded the base 64 string? Where we thought we got trolled, We the obtained string `thisisnottheflag`.\n\n**It is not the flag, but it's the password for this tool !** 🤯🤯\n\n\n\u003cbr\u003e\n\u003cp align=\"center\"\u003e\n\u003cimg src=\"./images/xiao-steg-password.png\" alt=\"xiao-steg\" /\u003e\u003cbr\u003e\n\u003ci\u003eXiao Steganography Tool\u003c/i\u003e\n\u003c/p\u003e\n\u003cbr\u003e\n\n\nWith that, we now got have a valid ZIP file. Clicking on it now prompts us for another password. What the ... 🤬\n\n\n\u003cbr\u003e\n\u003cp align=\"center\"\u003e\n\u003cimg src=\"./images/new-yes.png\" alt=\"new-yes\" /\u003e\u003cbr\u003e\n\u003ci\u003eProper Zip file but still asking for password !!!\u003c/i\u003e\n\u003c/p\u003e\n\u003cbr\u003e\n\n\nAt this point, we thought that it might not actually be encrypted. Perhaps those classic broken ZIP file challenges. So we threw this new ZIP into \u003ca href=\"https://www.x-ways.net/winhex/\"\u003eWinHex\u003c/a\u003e and ***WOAH*** we found the flag (or so we thought... trolled once again 😭😭😭)\n\n\n\u003cbr\u003e\n\u003cp align=\"center\"\u003e\n\u003cimg src=\"./images/fake-flag.png\" alt=\"fake-flag\" /\u003e\u003cbr\u003e\n\u003ci\u003eWin Hex - Proper Zip\u003c/i\u003e\n\u003c/p\u003e\n\u003cbr\u003e\n\n\nWe submitted the \"flag\" `govtech-csg{Th1sisn0ty3tthefl@g}` to the challenge platform, guess what? Tt's fake ...\n\nBut wait ... \"not yet the flag\"? Could this actually be the password for the ZIP?\n\n\n\u003cbr\u003e\n\u003cp align=\"center\"\u003e\n\u003cimg src=\"./images/real-flag.png\" alt=\"real-flag\" /\u003e\u003cbr\u003e\n\u003ci\u003eThe Real Flag !\u003c/i\u003e\n\u003c/p\u003e\n\u003cbr\u003e\n\n\nAnd there we go! We solved this challenge and got a clue to the next challenge 🌟\n\n## \u003cu\u003eConclusion\u003c/u\u003e\n\nLet us close this writeup with some key takeaways and learning points:\n\n✅ Play lots of CTFs !! As seen throughout the writeup, we are generally correct when it comes to our guesses (steganography, base64, brainfuck, etc..). By playing lots of CTFs, you will gain new experiences which could prove to be useful for future CTFs. \n\n✅ Don't give up, throughout this challenge we faced many roadblocks ***BUT, we believed*** and we pulled through!\n\n✅ Have fun! Honestly, we joked a lot about the fake flags, but hey, this challenge was actually pretty fun 😉\n\n\n\nSpecial thanks to the members of team ***Ov3rWr1t3*** for pulling through. To those reading till this point, I hope you find this insightful and happy CTF-ing!\n\nSigning off\u003cbr\u003e\n**~K0p1**\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fk0p1-git%2Fstacks2020-voicesinthehead","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fk0p1-git%2Fstacks2020-voicesinthehead","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fk0p1-git%2Fstacks2020-voicesinthehead/lists"}